CVE-2020-24346
📋 TL;DR
CVE-2020-24346 is a use-after-free vulnerability in njs (NGINX JavaScript) through version 0.4.3 that allows attackers to potentially execute arbitrary code or cause denial of service. It affects NGINX deployments using njs for JSON parsing. The vulnerability occurs when processing malformed JSON data.
💻 Affected Systems
- NGINX with njs module
- NetApp products using vulnerable njs
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial of service causing NGINX worker crashes and service disruption.
If Mitigated
Limited impact with proper network segmentation and minimal privileges.
🎯 Exploit Status
Proof-of-concept available in GitHub issue. Exploitation requires sending malformed JSON to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: njs 0.4.4 and later
Vendor Advisory: https://github.com/nginx/njs/issues/325
Restart Required: Yes
Instructions:
1. Update njs to version 0.4.4 or later. 2. Recompile NGINX with updated njs module. 3. Restart NGINX service. 4. Verify version with 'njs -v'.
🔧 Temporary Workarounds
Disable njs JSON parsing
allTemporarily disable njs JSON processing if not required
Comment out or remove njs_json directives in NGINX configuration
Input validation
allImplement strict JSON validation before njs processing
Add validation layer in application code or NGINX lua module
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy WAF rules to block malformed JSON payloads
🔍 How to Verify
Check if Vulnerable:
Check njs version with 'njs -v' or examine NGINX configuration for njs module usageCheck Version:
njs -vVerify Fix Applied:
Confirm njs version is 0.4.4+ with 'njs -v' and test JSON processing functionality📡 Detection & Monitoring
Log Indicators:
- NGINX worker crashes
- Segmentation fault errors in logs
- Unusual JSON payloads in access logs
Network Indicators:
- Malformed JSON requests to NGINX endpoints
- Repeated connection attempts with invalid JSON
SIEM Query:
source="nginx" AND ("segmentation fault" OR "worker process" AND exit)